@pepu-chain/sdk 0.0.0-stage → 0.2.0

package/dist/chunk-EHBPIYY4.js

@@ -0,0 +1,262 @@
+import { createPepuPrivyConfig } from './chunk-JLZ4LZ4Z.js';
+import { PRIVY_ENV } from './chunk-3XUGQODR.js';
+import { PEPU_ERROR_CATALOG, PepuAuthError, PepuError, toPepuError } from './chunk-6DSZ4Z2N.js';
+import { createElement, Fragment, useEffect, useState, useRef, useCallback } from 'react';
+import { PrivyProvider, useWallets, getEmbeddedConnectedWallet, usePrivy, useUser } from '@privy-io/react-auth';
+
+// src/privy/ensure-client.ts
+var DEFAULT_ENSURE_ENDPOINT = "/api/wallet/ensure";
+var DEFAULT_ENSURE_REQUEST_TIMEOUT_MS = 2e4;
+var DEFAULT_ENSURE_APPEAR_TIMEOUT_MS = 8e3;
+var KNOWN_CODES = new Set(PEPU_ERROR_CATALOG.map((e) => e.code));
+var isRecord = (v) => typeof v === "object" && v !== null;
+function errorFromEnsureResponse(status, body) {
+  const err = isRecord(body) ? body["error"] : void 0;
+  if (isRecord(err)) {
+    const code = typeof err["code"] === "string" && KNOWN_CODES.has(err["code"]) ? err["code"] : "UNKNOWN";
+    const message2 = typeof err["message"] === "string" ? err["message"] : `Wallet setup failed (HTTP ${status}).`;
+    const hint = typeof err["hint"] === "string" ? err["hint"] : void 0;
+    const opts = { status, ...hint !== void 0 ? { hint } : {} };
+    return status === 401 ? new PepuAuthError(code, message2, opts) : new PepuError(code, message2, opts);
+  }
+  const message = typeof err === "string" ? err : `Wallet setup failed (HTTP ${status}).`;
+  if (status === 401) return new PepuAuthError("AUTH_INVALID_TOKEN", message, { status });
+  return new PepuError("WALLET_NOT_PROVISIONED", message, { status });
+}
+async function requestEnsureWallet(o) {
+  const token = await o.getAccessToken();
+  if (!token) {
+    throw new PepuAuthError(
+      "AUTH_INVALID_TOKEN",
+      "Could not get a Privy access token for this session. Try signing in again."
+    );
+  }
+  const controller = new AbortController();
+  const timeoutMs = o.timeoutMs ?? DEFAULT_ENSURE_REQUEST_TIMEOUT_MS;
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, timeoutMs);
+  const onAbort = () => controller.abort();
+  o.signal?.addEventListener("abort", onAbort);
+  try {
+    const doFetch = o.fetch ?? globalThis.fetch;
+    let response;
+    try {
+      response = await doFetch(o.endpoint ?? DEFAULT_ENSURE_ENDPOINT, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}` },
+        signal: controller.signal
+      });
+    } catch (e) {
+      if (timedOut) {
+        throw new PepuError("WALLET_NOT_PROVISIONED", "Wallet setup timed out. Please try again.", {
+          retryable: true,
+          cause: e
+        });
+      }
+      throw toPepuError(e, { op: "ensure wallet" });
+    }
+    const body = await response.json().catch(() => null);
+    if (!response.ok) throw errorFromEnsureResponse(response.status, body);
+    const address = isRecord(body) ? body["address"] : void 0;
+    if (typeof address !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(address)) {
+      throw new PepuError("WALLET_NOT_PROVISIONED", "The ensure-wallet route did not return a wallet address.", {
+        status: 502
+      });
+    }
+    return { address, created: isRecord(body) && body["created"] === true };
+  } finally {
+    clearTimeout(timer);
+    o.signal?.removeEventListener("abort", onAbort);
+  }
+}
+
+// src/privy/react.ts
+function composeProviders(layers, leaves = []) {
+  return function ComposedProviders({ children }) {
+    let node = createElement(
+      Fragment,
+      null,
+      ...leaves.map((Leaf, i) => createElement(Leaf, { key: `leaf-${i}` })),
+      children
+    );
+    for (let i = layers.length - 1; i >= 0; i--) {
+      const layer = layers[i];
+      if (!layer) continue;
+      node = createElement(layer[0], layer[1], node);
+    }
+    return node;
+  };
+}
+function PepuPrivyProvider(props) {
+  const { appId, config, fallback, wrapper, children } = props;
+  if (!appId) {
+    return createElement(
+      Fragment,
+      null,
+      fallback ?? createElement(
+        "div",
+        { role: "alert" },
+        `Missing ${PRIVY_ENV.appId}. Set it to your Privy app id and restart the dev server.`
+      )
+    );
+  }
+  const inner = wrapper ? createElement(wrapper, null, children) : children;
+  return createElement(PrivyProvider, {
+    appId,
+    config: createPepuPrivyConfig(config),
+    children: inner
+  });
+}
+function useEmbeddedWallet() {
+  const { wallets, ready } = useWallets();
+  const wallet = getEmbeddedConnectedWallet(wallets);
+  const external = wallets.filter((w) => w !== wallet);
+  return wallet ? { ready, wallet, address: wallet.address, external } : { ready, wallet: null, external };
+}
+function shouldPinEmbeddedWallet(o) {
+  if (!o.enabled || !o.ready || !o.embeddedAddress) return false;
+  return o.activeAddress?.toLowerCase() !== o.embeddedAddress.toLowerCase();
+}
+function usePinEmbeddedWallet(o) {
+  const { enabled, activeAddress, setActiveWallet } = o;
+  const { wallets, ready } = useWallets();
+  const embedded = getEmbeddedConnectedWallet(wallets);
+  const embeddedAddress = embedded?.address;
+  useEffect(() => {
+    if (!embedded) return;
+    if (!shouldPinEmbeddedWallet({ enabled, ready, embeddedAddress, activeAddress })) return;
+    void setActiveWallet(embedded);
+  }, [enabled, ready, embedded, embeddedAddress, activeAddress, setActiveWallet]);
+}
+function useEnsureWallet(o = {}) {
+  const endpoint = o.endpoint ?? DEFAULT_ENSURE_ENDPOINT;
+  const requestTimeoutMs = o.requestTimeoutMs ?? DEFAULT_ENSURE_REQUEST_TIMEOUT_MS;
+  const appearTimeoutMs = o.appearTimeoutMs ?? DEFAULT_ENSURE_APPEAR_TIMEOUT_MS;
+  const { ready: privyReady, authenticated, getAccessToken } = usePrivy();
+  const { wallets, ready: walletsReady } = useWallets();
+  const { refreshUser } = useUser();
+  const [error, setError] = useState(null);
+  const [requesting, setRequesting] = useState(false);
+  const [confirmed, setConfirmed] = useState(null);
+  const [stalled, setStalled] = useState(false);
+  const [attempt, setAttempt] = useState(0);
+  const settledFor = useRef(-1);
+  const getAccessTokenRef = useRef(getAccessToken);
+  const refreshUserRef = useRef(refreshUser);
+  getAccessTokenRef.current = getAccessToken;
+  refreshUserRef.current = refreshUser;
+  const embedded = getEmbeddedConnectedWallet(wallets);
+  const hasWallet = embedded !== null;
+  useEffect(() => {
+    if (!privyReady || !authenticated || !walletsReady || hasWallet) return;
+    if (settledFor.current === attempt) return;
+    let cancelled = false;
+    const controller = new AbortController();
+    setRequesting(true);
+    void (async () => {
+      try {
+        const { address } = await requestEnsureWallet({
+          getAccessToken: () => getAccessTokenRef.current(),
+          endpoint,
+          timeoutMs: requestTimeoutMs,
+          signal: controller.signal
+        });
+        await refreshUserRef.current();
+        if (cancelled) return;
+        settledFor.current = attempt;
+        setConfirmed(address);
+      } catch (e) {
+        if (cancelled) return;
+        settledFor.current = attempt;
+        setError(toPepuError(e, { op: "ensure wallet" }));
+      } finally {
+        if (!cancelled) setRequesting(false);
+      }
+    })();
+    return () => {
+      cancelled = true;
+      controller.abort();
+    };
+  }, [privyReady, authenticated, walletsReady, hasWallet, attempt, endpoint, requestTimeoutMs]);
+  useEffect(() => {
+    if (!confirmed || hasWallet) return;
+    const id = setTimeout(() => setStalled(true), appearTimeoutMs);
+    return () => {
+      clearTimeout(id);
+      setStalled(false);
+    };
+  }, [confirmed, hasWallet, appearTimeoutMs]);
+  const retry = useCallback(() => {
+    setError(null);
+    setConfirmed(null);
+    setStalled(false);
+    setRequesting(false);
+    setAttempt((n) => n + 1);
+  }, []);
+  if (hasWallet) return { status: "ready", address: embedded.address, retry };
+  if (!privyReady || !authenticated || !walletsReady) return { status: "idle", retry };
+  if (error) return { status: "error", error, retry };
+  if (stalled && confirmed) return { status: "stalled", address: confirmed, retry };
+  if (confirmed) return { status: "checking", address: confirmed, retry };
+  return { status: requesting ? "creating" : "checking", retry };
+}
+function WalletGate(p) {
+  const ensure = useEnsureWallet(p.endpoint !== void 0 ? { endpoint: p.endpoint } : {});
+  if (ensure.status === "ready") return createElement(Fragment, null, p.children);
+  if (ensure.status === "error" && ensure.error) {
+    const { error, retry } = ensure;
+    return createElement(
+      Fragment,
+      null,
+      p.error ? p.error(error, retry) : createElement(
+        "div",
+        { role: "alert" },
+        createElement("p", null, "Could not create your wallet."),
+        createElement("p", null, error.message),
+        createElement("button", { type: "button", onClick: retry }, "Try again")
+      )
+    );
+  }
+  if (ensure.status === "stalled" && ensure.address) {
+    const a = ensure.address;
+    const reload = () => globalThis.location.reload();
+    if (p.stalled) return createElement(Fragment, null, p.stalled(a, reload));
+    return createElement(
+      "div",
+      { role: "status" },
+      createElement("p", null, `Your wallet was created (${a.slice(0, 6)}\u2026${a.slice(-4)}), but it has not appeared in this session yet.`),
+      createElement("p", null, "This is a client sync delay, not a lost wallet. Reloading usually fixes it."),
+      createElement("button", { type: "button", onClick: reload }, "Reload")
+    );
+  }
+  return createElement(
+    Fragment,
+    null,
+    p.loading ?? createElement("div", { role: "status", "aria-label": "Loading" }, "Setting up your wallet\u2026")
+  );
+}
+function usePepuAuthFetch() {
+  const { getAccessToken } = usePrivy();
+  return useCallback(
+    async (input, init) => {
+      const token = await getAccessToken();
+      if (!token) {
+        throw new PepuAuthError(
+          "AUTH_INVALID_TOKEN",
+          "No Privy access token for this session. Sign in again."
+        );
+      }
+      const headers = new Headers(init?.headers);
+      headers.set("Authorization", `Bearer ${token}`);
+      return fetch(input, { ...init, headers });
+    },
+    [getAccessToken]
+  );
+}
+
+export { PepuPrivyProvider, WalletGate, composeProviders, requestEnsureWallet, shouldPinEmbeddedWallet, useEmbeddedWallet, useEnsureWallet, usePepuAuthFetch, usePinEmbeddedWallet };
+//# sourceMappingURL=chunk-EHBPIYY4.js.map
+//# sourceMappingURL=chunk-EHBPIYY4.js.map

package/dist/chunk-EHBPIYY4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/privy/ensure-client.ts","../src/privy/react.ts"],"names":["message"],"mappings":";;;;;;;AAaO,IAAM,uBAAA,GAA0B,oBAAA;AAEhC,IAAM,iCAAA,GAAoC,GAAA;AAE1C,IAAM,gCAAA,GAAmC,GAAA;AAEhD,IAAM,WAAA,GAAmC,IAAI,GAAA,CAAI,kBAAA,CAAmB,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAEtF,IAAM,WAAW,CAAC,CAAA,KAA6C,OAAO,CAAA,KAAM,YAAY,CAAA,KAAM,IAAA;AAMvF,SAAS,uBAAA,CAAwB,QAAgB,IAAA,EAA0B;AAChF,EAAA,MAAM,MAAM,QAAA,CAAS,IAAI,CAAA,GAAI,IAAA,CAAK,OAAO,CAAA,GAAI,MAAA;AAC7C,EAAA,IAAI,QAAA,CAAS,GAAG,CAAA,EAAG;AACjB,IAAA,MAAM,IAAA,GAAO,OAAO,GAAA,CAAI,MAAM,MAAM,QAAA,IAAY,WAAA,CAAY,GAAA,CAAI,GAAA,CAAI,MAAM,CAAC,CAAA,GAAK,GAAA,CAAI,MAAM,CAAA,GAAsB,SAAA;AAChH,IAAA,MAAMA,QAAAA,GAAU,OAAO,GAAA,CAAI,SAAS,CAAA,KAAM,WAAW,GAAA,CAAI,SAAS,CAAA,GAAI,CAAA,0BAAA,EAA6B,MAAM,CAAA,EAAA,CAAA;AACzG,IAAA,MAAM,IAAA,GAAO,OAAO,GAAA,CAAI,MAAM,MAAM,QAAA,GAAW,GAAA,CAAI,MAAM,CAAA,GAAI,MAAA;AAC7D,IAAA,MAAM,IAAA,GAAO,EAAE,MAAA,EAAQ,GAAI,IAAA,KAAS,SAAY,EAAE,IAAA,EAAK,GAAI,EAAC,EAAG;AAC/D,IAAA,OAAO,MAAA,KAAW,GAAA,GAAM,IAAI,aAAA,CAAc,IAAA,EAAMA,QAAAA,EAAS,IAAI,CAAA,GAAI,IAAI,SAAA,CAAU,IAAA,EAAMA,QAAAA,EAAS,IAAI,CAAA;AAAA,EACpG;AACA,EAAA,MAAM,UAAU,OAAO,GAAA,KAAQ,QAAA,GAAW,GAAA,GAAM,6BAA6B,MAAM,CAAA,EAAA,CAAA;AACnF,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,IAAI,cAAc,oBAAA,EAAsB,OAAA,EAAS,EAAE,MAAA,EAAQ,CAAA;AACtF,EAAA,OAAO,IAAI,SAAA,CAAU,wBAAA,EAA0B,OAAA,EAAS,EAAE,QAAQ,CAAA;AACpE;AAWA,eAAsB,oBAAoB,CAAA,EAMU;AAClD,EAAA,MAAM,KAAA,GAAQ,MAAM,CAAA,CAAE,cAAA,EAAe;AACrC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,oBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,SAAA,GAAY,EAAE,SAAA,IAAa,iCAAA;AACjC,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,UAAA,CAAW,KAAA,EAAM;AAAA,EACnB,GAAG,SAAS,CAAA;AACZ,EAAA,MAAM,OAAA,GAAU,MAAY,UAAA,CAAW,KAAA,EAAM;AAC7C,EAAA,CAAA,CAAE,MAAA,EAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAC3C,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,KAAA,IAAS,UAAA,CAAW,KAAA;AACtC,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,OAAA,CAAQ,CAAA,CAAE,QAAA,IAAY,uBAAA,EAAyB;AAAA,QAC9D,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAAA,QAC5C,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,MAAM,IAAI,SAAA,CAAU,wBAAA,EAA0B,2CAAA,EAA6C;AAAA,UACzF,SAAA,EAAW,IAAA;AAAA,UACX,KAAA,EAAO;AAAA,SACR,CAAA;AAAA,MACH;AACA,MAAA,MAAM,WAAA,CAAY,CAAA,EAAG,EAAE,EAAA,EAAI,iBAAiB,CAAA;AAAA,IAC9C;AACA,IAAA,MAAM,OAAgB,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC5D,IAAA,IAAI,CAAC,QAAA,CAAS,EAAA,QAAU,uBAAA,CAAwB,QAAA,CAAS,QAAQ,IAAI,CAAA;AACrE,IAAA,MAAM,UAAU,QAAA,CAAS,IAAI,CAAA,GAAI,IAAA,CAAK,SAAS,CAAA,GAAI,KAAA,CAAA;AACnD,IAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,CAAC,qBAAA,CAAsB,IAAA,CAAK,OAAO,CAAA,EAAG;AACvE,MAAA,MAAM,IAAI,SAAA,CAAU,wBAAA,EAA0B,0DAAA,EAA4D;AAAA,QACxG,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AACA,IAAA,OAAO,EAAE,SAA6B,OAAA,EAAS,QAAA,CAAS,IAAI,CAAA,IAAK,IAAA,CAAK,SAAS,CAAA,KAAM,IAAA,EAAK;AAAA,EAC5F,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAClB,IAAA,CAAA,CAAE,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,EAChD;AACF;;;AClDO,SAAS,gBAAA,CACd,MAAA,EACA,MAAA,GAA0D,EAAC,EAClB;AACzC,EAAA,OAAO,SAAS,iBAAA,CAAkB,EAAE,QAAA,EAAS,EAA2C;AACtF,IAAA,IAAI,IAAA,GAAqB,aAAA;AAAA,MACvB,QAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAG,MAAA,CAAO,GAAA,CAAI,CAAC,MAAM,CAAA,KAAM,aAAA,CAAc,IAAA,EAAyC,EAAE,GAAA,EAAK,CAAA,KAAA,EAAQ,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA;AAAA,MACvG;AAAA,KACF;AACA,IAAA,KAAA,IAAS,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,CAAA,IAAK,GAAG,CAAA,EAAA,EAAK;AAC3C,MAAA,MAAM,KAAA,GAAQ,OAAO,CAAC,CAAA;AACtB,MAAA,IAAI,CAAC,KAAA,EAAO;AACZ,MAAA,IAAA,GAAO,cAAc,KAAA,CAAM,CAAC,GAAG,KAAA,CAAM,CAAC,GAAG,IAAI,CAAA;AAAA,IAC/C;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AACF;AAiBO,SAAS,kBAAkB,KAAA,EAA6C;AAC7E,EAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,OAAA,EAAS,UAAS,GAAI,KAAA;AACvD,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,aAAA;AAAA,MACL,QAAA;AAAA,MACA,IAAA;AAAA,MACA,QAAA,IACE,aAAA;AAAA,QACE,KAAA;AAAA,QACA,EAAE,MAAM,OAAA,EAAQ;AAAA,QAChB,CAAA,QAAA,EAAW,UAAU,KAAK,CAAA,yDAAA;AAAA;AAC5B,KACJ;AAAA,EACF;AACA,EAAA,MAAM,QAAmB,OAAA,GAAU,aAAA,CAAc,OAAA,EAAS,IAAA,EAAM,QAAQ,CAAA,GAAI,QAAA;AAC5E,EAAA,OAAO,cAAc,aAAA,EAAe;AAAA,IAClC,KAAA;AAAA,IACA,MAAA,EAAQ,sBAAsB,MAAM,CAAA;AAAA,IACpC,QAAA,EAAU;AAAA,GACX,CAAA;AACH;AAkBO,SAAS,iBAAA,GAKd;AACA,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,UAAA,EAAW;AACtC,EAAA,MAAM,MAAA,GAAS,2BAA2B,OAAO,CAAA;AACjD,EAAA,MAAM,WAAW,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAM,MAAM,MAAM,CAAA;AACnD,EAAA,OAAO,MAAA,GACH,EAAE,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAS,MAAA,CAAO,OAAA,EAAoB,QAAA,EAAS,GAC9D,EAAE,KAAA,EAAO,MAAA,EAAQ,MAAM,QAAA,EAAS;AACtC;AAYO,SAAS,wBAAwB,CAAA,EAK5B;AACV,EAAA,IAAI,CAAC,EAAE,OAAA,IAAW,CAAC,EAAE,KAAA,IAAS,CAAC,CAAA,CAAE,eAAA,EAAiB,OAAO,KAAA;AACzD,EAAA,OAAO,EAAE,aAAA,EAAe,WAAA,EAAY,KAAM,CAAA,CAAE,gBAAgB,WAAA,EAAY;AAC1E;AAeO,SAAS,qBAAqB,CAAA,EAI5B;AACP,EAAA,MAAM,EAAE,OAAA,EAAS,aAAA,EAAe,eAAA,EAAgB,GAAI,CAAA;AACpD,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,UAAA,EAAW;AACtC,EAAA,MAAM,QAAA,GAAW,2BAA2B,OAAO,CAAA;AACnD,EAAA,MAAM,kBAAkB,QAAA,EAAU,OAAA;AAClC,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,QAAA,EAAU;AACf,IAAA,IAAI,CAAC,wBAAwB,EAAE,OAAA,EAAS,OAAO,eAAA,EAAiB,aAAA,EAAe,CAAA,EAAG;AAClF,IAAA,KAAK,gBAAgB,QAAQ,CAAA;AAAA,EAC/B,CAAA,EAAG,CAAC,OAAA,EAAS,KAAA,EAAO,UAAU,eAAA,EAAiB,aAAA,EAAe,eAAe,CAAC,CAAA;AAChF;AAuBO,SAAS,eAAA,CAAgB,CAAA,GAAgF,EAAC,EAK/G;AACA,EAAA,MAAM,QAAA,GAAW,EAAE,QAAA,IAAY,uBAAA;AAC/B,EAAA,MAAM,gBAAA,GAAmB,EAAE,gBAAA,IAAoB,iCAAA;AAC/C,EAAA,MAAM,eAAA,GAAkB,EAAE,eAAA,IAAmB,gCAAA;AAE7C,EAAA,MAAM,EAAE,KAAA,EAAO,UAAA,EAAY,aAAA,EAAe,cAAA,KAAmB,QAAA,EAAS;AACtE,EAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAO,YAAA,KAAiB,UAAA,EAAW;AACpD,EAAA,MAAM,EAAE,WAAA,EAAY,GAAI,OAAA,EAAQ;AAEhC,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAA2B,IAAI,CAAA;AACzD,EAAA,MAAM,CAAC,UAAA,EAAY,aAAa,CAAA,GAAI,SAAS,KAAK,CAAA;AAClD,EAAA,MAAM,CAAC,SAAA,EAAW,YAAY,CAAA,GAAI,SAAyB,IAAI,CAAA;AAC/D,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,KAAK,CAAA;AAC5C,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,CAAC,CAAA;AAIxC,EAAA,MAAM,UAAA,GAAa,OAAO,EAAE,CAAA;AAG5B,EAAA,MAAM,iBAAA,GAAoB,OAAO,cAAc,CAAA;AAC/C,EAAA,MAAM,cAAA,GAAiB,OAAO,WAAW,CAAA;AACzC,EAAA,iBAAA,CAAkB,OAAA,GAAU,cAAA;AAC5B,EAAA,cAAA,CAAe,OAAA,GAAU,WAAA;AAEzB,EAAA,MAAM,QAAA,GAAW,2BAA2B,OAAO,CAAA;AACnD,EAAA,MAAM,YAAY,QAAA,KAAa,IAAA;AAE/B,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,UAAA,IAAc,CAAC,aAAA,IAAiB,CAAC,gBAAgB,SAAA,EAAW;AACjE,IAAA,IAAI,UAAA,CAAW,YAAY,OAAA,EAAS;AAEpC,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,aAAA,CAAc,IAAI,CAAA;AAClB,IAAA,KAAA,CAAM,YAAY;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,mBAAA,CAAoB;AAAA,UAC5C,cAAA,EAAgB,MAAM,iBAAA,CAAkB,OAAA,EAAQ;AAAA,UAChD,QAAA;AAAA,UACA,SAAA,EAAW,gBAAA;AAAA,UACX,QAAQ,UAAA,CAAW;AAAA,SACpB,CAAA;AAED,QAAA,MAAM,eAAe,OAAA,EAAQ;AAC7B,QAAA,IAAI,SAAA,EAAW;AACf,QAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AACrB,QAAA,YAAA,CAAa,OAAO,CAAA;AAAA,MACtB,SAAS,CAAA,EAAG;AACV,QAAA,IAAI,SAAA,EAAW;AACf,QAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AACrB,QAAA,QAAA,CAAS,YAAY,CAAA,EAAG,EAAE,EAAA,EAAI,eAAA,EAAiB,CAAC,CAAA;AAAA,MAClD,CAAA,SAAE;AACA,QAAA,IAAI,CAAC,SAAA,EAAW,aAAA,CAAc,KAAK,CAAA;AAAA,MACrC;AAAA,IACF,CAAA,GAAG;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,UAAA,CAAW,KAAA,EAAM;AAAA,IACnB,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,UAAA,EAAY,aAAA,EAAe,cAAc,SAAA,EAAW,OAAA,EAAS,QAAA,EAAU,gBAAgB,CAAC,CAAA;AAG5F,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,aAAa,SAAA,EAAW;AAC7B,IAAA,MAAM,KAAK,UAAA,CAAW,MAAM,UAAA,CAAW,IAAI,GAAG,eAAe,CAAA;AAC7D,IAAA,OAAO,MAAM;AACX,MAAA,YAAA,CAAa,EAAE,CAAA;AACf,MAAA,UAAA,CAAW,KAAK,CAAA;AAAA,IAClB,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,SAAA,EAAW,SAAA,EAAW,eAAe,CAAC,CAAA;AAE1C,EAAA,MAAM,KAAA,GAAQ,YAAY,MAAY;AACpC,IAAA,QAAA,CAAS,IAAI,CAAA;AACb,IAAA,YAAA,CAAa,IAAI,CAAA;AACjB,IAAA,UAAA,CAAW,KAAK,CAAA;AAChB,IAAA,aAAA,CAAc,KAAK,CAAA;AACnB,IAAA,UAAA,CAAW,CAAC,CAAA,KAAM,CAAA,GAAI,CAAC,CAAA;AAAA,EACzB,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,IAAI,SAAA,SAAkB,EAAE,MAAA,EAAQ,SAAS,OAAA,EAAS,QAAA,CAAS,SAAoB,KAAA,EAAM;AACrF,EAAA,IAAI,CAAC,UAAA,IAAc,CAAC,aAAA,IAAiB,CAAC,cAAc,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAM;AACnF,EAAA,IAAI,OAAO,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,OAAO,KAAA,EAAM;AAClD,EAAA,IAAI,OAAA,IAAW,WAAW,OAAO,EAAE,QAAQ,SAAA,EAAW,OAAA,EAAS,WAAW,KAAA,EAAM;AAChF,EAAA,IAAI,WAAW,OAAO,EAAE,QAAQ,UAAA,EAAY,OAAA,EAAS,WAAW,KAAA,EAAM;AACtE,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,GAAa,UAAA,GAAa,YAAY,KAAA,EAAM;AAC/D;AAsBO,SAAS,WAAW,CAAA,EAUV;AACf,EAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,CAAA,CAAE,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,EAAU,CAAA,CAAE,QAAA,EAAS,GAAI,EAAE,CAAA;AACvF,EAAA,IAAI,MAAA,CAAO,WAAW,OAAA,EAAS,OAAO,cAAc,QAAA,EAAU,IAAA,EAAM,EAAE,QAAQ,CAAA;AAE9E,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,OAAA,IAAW,MAAA,CAAO,KAAA,EAAO;AAC7C,IAAA,MAAM,EAAE,KAAA,EAAO,KAAA,EAAM,GAAI,MAAA;AACzB,IAAA,OAAO,aAAA;AAAA,MACL,QAAA;AAAA,MACA,IAAA;AAAA,MACA,EAAE,KAAA,GACE,CAAA,CAAE,KAAA,CAAM,KAAA,EAAO,KAAK,CAAA,GACpB,aAAA;AAAA,QACE,KAAA;AAAA,QACA,EAAE,MAAM,OAAA,EAAQ;AAAA,QAChB,aAAA,CAAc,GAAA,EAAK,IAAA,EAAM,+BAA+B,CAAA;AAAA,QACxD,aAAA,CAAc,GAAA,EAAK,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA;AAAA,QACtC,aAAA,CAAc,UAAU,EAAE,IAAA,EAAM,UAAU,OAAA,EAAS,KAAA,IAAS,WAAW;AAAA;AACzE,KACN;AAAA,EACF;AAEA,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,SAAA,IAAa,MAAA,CAAO,OAAA,EAAS;AACjD,IAAA,MAAM,IAAI,MAAA,CAAO,OAAA;AACjB,IAAA,MAAM,MAAA,GAAS,MAAa,UAAA,CAA2D,QAAA,CAAS,MAAA,EAAO;AACvG,IAAA,IAAI,CAAA,CAAE,OAAA,EAAS,OAAO,aAAA,CAAc,QAAA,EAAU,MAAM,CAAA,CAAE,OAAA,CAAQ,CAAA,EAAG,MAAM,CAAC,CAAA;AACxE,IAAA,OAAO,aAAA;AAAA,MACL,KAAA;AAAA,MACA,EAAE,MAAM,QAAA,EAAS;AAAA,MACjB,aAAA,CAAc,GAAA,EAAK,IAAA,EAAM,CAAA,yBAAA,EAA4B,EAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,MAAA,EAAI,CAAA,CAAE,KAAA,CAAM,EAAE,CAAC,CAAA,+CAAA,CAAiD,CAAA;AAAA,MAClI,aAAA,CAAc,GAAA,EAAK,IAAA,EAAM,6EAA6E,CAAA;AAAA,MACtG,aAAA,CAAc,UAAU,EAAE,IAAA,EAAM,UAAU,OAAA,EAAS,MAAA,IAAU,QAAQ;AAAA,KACvE;AAAA,EACF;AAEA,EAAA,OAAO,aAAA;AAAA,IACL,QAAA;AAAA,IACA,IAAA;AAAA,IACA,CAAA,CAAE,OAAA,IAAW,aAAA,CAAc,KAAA,EAAO,EAAE,MAAM,QAAA,EAAU,YAAA,EAAc,SAAA,EAAU,EAAG,8BAAyB;AAAA,GAC1G;AACF;AAgBO,SAAS,gBAAA,GAAiF;AAC/F,EAAA,MAAM,EAAE,cAAA,EAAe,GAAI,QAAA,EAAS;AACpC,EAAA,OAAO,WAAA;AAAA,IACL,OAAO,OAAmB,IAAA,KAA0C;AAClE,MAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe;AACnC,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,MAAM,IAAI,aAAA;AAAA,UACR,oBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AACzC,MAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAC9C,MAAA,OAAO,MAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,IAC1C,CAAA;AAAA,IACA,CAAC,cAAc;AAAA,GACjB;AACF","file":"chunk-EHBPIYY4.js","sourcesContent":["import type { Address } from \"viem\";\nimport { PEPU_ERROR_CATALOG, PepuAuthError, PepuError, toPepuError } from \"../errors.js\";\nimport type { PepuErrorCode } from \"../errors.js\";\n\n/**\n * Framework-free client for the ensure-wallet route. No React, no Privy: the\n * hooks in `./react.ts` wrap it, and tests drive it directly.\n *\n * Ported from templates/consumer-app/components/wallet-gate.tsx (request,\n * timeout and response handling).\n */\n\n/** Default route path, matching `createEnsureWalletRoute()`. */\nexport const DEFAULT_ENSURE_ENDPOINT = \"/api/wallet/ensure\";\n/** Bound on the request itself (consumer-app: ENSURE_REQUEST_TIMEOUT_MS). */\nexport const DEFAULT_ENSURE_REQUEST_TIMEOUT_MS = 20_000;\n/** Bound on waiting for the wallet to show up client-side (consumer-app: APPEAR_IN_CLIENT_TIMEOUT_MS). */\nexport const DEFAULT_ENSURE_APPEAR_TIMEOUT_MS = 8_000;\n\nconst KNOWN_CODES: ReadonlySet<string> = new Set(PEPU_ERROR_CATALOG.map((e) => e.code));\n\nconst isRecord = (v: unknown): v is Record<string, unknown> => typeof v === \"object\" && v !== null;\n\n/**\n * Turn a non-2xx response body into a typed error. Understands the SDK shape\n * `{ error: { code, message, hint } }` and the legacy `{ error: \"text\" }`.\n */\nexport function errorFromEnsureResponse(status: number, body: unknown): PepuError {\n  const err = isRecord(body) ? body[\"error\"] : undefined;\n  if (isRecord(err)) {\n    const code = typeof err[\"code\"] === \"string\" && KNOWN_CODES.has(err[\"code\"]) ? (err[\"code\"] as PepuErrorCode) : \"UNKNOWN\";\n    const message = typeof err[\"message\"] === \"string\" ? err[\"message\"] : `Wallet setup failed (HTTP ${status}).`;\n    const hint = typeof err[\"hint\"] === \"string\" ? err[\"hint\"] : undefined;\n    const opts = { status, ...(hint !== undefined ? { hint } : {}) };\n    return status === 401 ? new PepuAuthError(code, message, opts) : new PepuError(code, message, opts);\n  }\n  const message = typeof err === \"string\" ? err : `Wallet setup failed (HTTP ${status}).`;\n  if (status === 401) return new PepuAuthError(\"AUTH_INVALID_TOKEN\", message, { status });\n  return new PepuError(\"WALLET_NOT_PROVISIONED\", message, { status });\n}\n\n/**\n * POST to the ensure-wallet route with the user's Privy access token and return\n * the wallet address. Bounded by a timeout. Never leaks the token in errors.\n *\n * @example\n * ```ts\n * const { address } = await requestEnsureWallet({ getAccessToken, endpoint: \"/api/wallet/ensure\" });\n * ```\n */\nexport async function requestEnsureWallet(o: {\n  getAccessToken: () => Promise<string | null>;\n  endpoint?: string;\n  timeoutMs?: number;\n  fetch?: typeof fetch;\n  signal?: AbortSignal;\n}): Promise<{ address: Address; created: boolean }> {\n  const token = await o.getAccessToken();\n  if (!token) {\n    throw new PepuAuthError(\n      \"AUTH_INVALID_TOKEN\",\n      \"Could not get a Privy access token for this session. Try signing in again.\",\n    );\n  }\n  const controller = new AbortController();\n  const timeoutMs = o.timeoutMs ?? DEFAULT_ENSURE_REQUEST_TIMEOUT_MS;\n  let timedOut = false;\n  const timer = setTimeout(() => {\n    timedOut = true;\n    controller.abort();\n  }, timeoutMs);\n  const onAbort = (): void => controller.abort();\n  o.signal?.addEventListener(\"abort\", onAbort);\n  try {\n    const doFetch = o.fetch ?? globalThis.fetch;\n    let response: Response;\n    try {\n      response = await doFetch(o.endpoint ?? DEFAULT_ENSURE_ENDPOINT, {\n        method: \"POST\",\n        headers: { Authorization: `Bearer ${token}` },\n        signal: controller.signal,\n      });\n    } catch (e) {\n      if (timedOut) {\n        throw new PepuError(\"WALLET_NOT_PROVISIONED\", \"Wallet setup timed out. Please try again.\", {\n          retryable: true,\n          cause: e,\n        });\n      }\n      throw toPepuError(e, { op: \"ensure wallet\" });\n    }\n    const body: unknown = await response.json().catch(() => null);\n    if (!response.ok) throw errorFromEnsureResponse(response.status, body);\n    const address = isRecord(body) ? body[\"address\"] : undefined;\n    if (typeof address !== \"string\" || !/^0x[0-9a-fA-F]{40}$/.test(address)) {\n      throw new PepuError(\"WALLET_NOT_PROVISIONED\", \"The ensure-wallet route did not return a wallet address.\", {\n        status: 502,\n      });\n    }\n    return { address: address as Address, created: isRecord(body) && body[\"created\"] === true };\n  } finally {\n    clearTimeout(timer);\n    o.signal?.removeEventListener(\"abort\", onAbort);\n  }\n}\n","import { createElement, Fragment, useCallback, useEffect, useRef, useState } from \"react\";\nimport type { ComponentType, ReactElement, ReactNode } from \"react\";\nimport { getEmbeddedConnectedWallet, PrivyProvider, usePrivy, useUser, useWallets } from \"@privy-io/react-auth\";\nimport type { ConnectedWallet, PrivyClientConfig } from \"@privy-io/react-auth\";\nimport type { Address } from \"viem\";\nimport { PepuAuthError, PepuError, toPepuError } from \"../errors.js\";\nimport { createPepuPrivyConfig, PRIVY_ENV } from \"./config.js\";\nimport type { CreatePepuPrivyConfigOptions } from \"./config.js\";\nimport {\n  DEFAULT_ENSURE_APPEAR_TIMEOUT_MS,\n  DEFAULT_ENSURE_ENDPOINT,\n  DEFAULT_ENSURE_REQUEST_TIMEOUT_MS,\n  requestEnsureWallet,\n} from \"./ensure-client.js\";\n\n/**\n * `@pepu-chain/sdk/privy/react` (browser). Provider, embedded-wallet\n * detection, wallet provisioning and the gate. Add `\"use client\"` in the file\n * where you import these from a Next.js server component.\n *\n * `react` and `@privy-io/react-auth` are optional peers of this entry only.\n */\n\nexport { requestEnsureWallet } from \"./ensure-client.js\";\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport interface PepuPrivyProviderProps {\n  /** Privy app id. When missing, `fallback` renders instead of throwing deep inside Privy. */\n  appId: string | undefined;\n  /** Overrides for {@link createPepuPrivyConfig}. */\n  config?: Partial<CreatePepuPrivyConfigOptions> | undefined;\n  /** Shown when `appId` is empty. Defaults to a short notice naming the env variable. */\n  fallback?: ReactNode;\n  /**\n   * Extra providers rendered inside PrivyProvider (used by `/privy/wagmi`).\n   * Build one with {@link composeProviders}.\n   */\n  wrapper?: ComponentType<{ children?: ReactNode }> | undefined;\n  children?: ReactNode;\n}\n\n/**\n * Compose providers (outermost first) into one wrapper component, with optional\n * leaf components rendered next to `children` in the innermost position. A\n * building block for `/privy/wagmi`; it keeps `react` imports in this entry.\n *\n * @example\n * ```ts\n * const Wrapper = composeProviders([[QueryClientProvider, { client }]], [MyEffectOnlyComponent]);\n * ```\n */\nexport function composeProviders(\n  layers: readonly (readonly [ComponentType<any>, Record<string, unknown>])[], // eslint-disable-line @typescript-eslint/no-explicit-any\n  leaves: readonly ComponentType<Record<string, never>>[] = [],\n): ComponentType<{ children?: ReactNode }> {\n  return function ComposedProviders({ children }: { children?: ReactNode }): ReactElement {\n    let node: ReactElement = createElement(\n      Fragment,\n      null,\n      ...leaves.map((Leaf, i) => createElement(Leaf as ComponentType<{ key?: string }>, { key: `leaf-${i}` })),\n      children,\n    );\n    for (let i = layers.length - 1; i >= 0; i--) {\n      const layer = layers[i];\n      if (!layer) continue;\n      node = createElement(layer[0], layer[1], node);\n    }\n    return node;\n  };\n}\n\n/**\n * `<PrivyProvider>` preconfigured for PEPU: mainnet only, Coinbase pinned to\n * `eoaOnly`, wallet creation off (the server provisions it, see\n * {@link WalletGate}). Renders `fallback` instead of crashing when `appId` is\n * missing.\n *\n * Ported from templates/consumer-app/app/providers.tsx.\n *\n * @example\n * ```tsx\n * <PepuPrivyProvider appId={process.env.NEXT_PUBLIC_PRIVY_APP_ID} config={{ loginMethods: [\"email\", \"google\"] }}>\n *   <App />\n * </PepuPrivyProvider>\n * ```\n */\nexport function PepuPrivyProvider(props: PepuPrivyProviderProps): ReactElement {\n  const { appId, config, fallback, wrapper, children } = props;\n  if (!appId) {\n    return createElement(\n      Fragment,\n      null,\n      fallback ??\n        createElement(\n          \"div\",\n          { role: \"alert\" },\n          `Missing ${PRIVY_ENV.appId}. Set it to your Privy app id and restart the dev server.`,\n        ),\n    );\n  }\n  const inner: ReactNode = wrapper ? createElement(wrapper, null, children) : children;\n  return createElement(PrivyProvider, {\n    appId,\n    config: createPepuPrivyConfig(config) as unknown as PrivyClientConfig,\n    children: inner,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Embedded wallet\n// ---------------------------------------------------------------------------\n\n/**\n * This user's Privy embedded wallet, separated from any external wallet Privy\n * is tracking (an installed MetaMask or Phantom). Never re-implements the\n * embedded filter: it calls Privy's `getEmbeddedConnectedWallet`.\n *\n * Ported from templates/consumer-app/lib/wallet.ts (`useWalletSnapshot`).\n *\n * @example\n * ```tsx\n * const { ready, address, external } = useEmbeddedWallet();\n * ```\n */\nexport function useEmbeddedWallet(): {\n  ready: boolean;\n  wallet: ConnectedWallet | null;\n  address?: Address;\n  external: ConnectedWallet[];\n} {\n  const { wallets, ready } = useWallets();\n  const wallet = getEmbeddedConnectedWallet(wallets);\n  const external = wallets.filter((w) => w !== wallet);\n  return wallet\n    ? { ready, wallet, address: wallet.address as Address, external }\n    : { ready, wallet: null, external };\n}\n\n/**\n * Pure decision behind the pin hooks: pin only when enabled, hydrated, an\n * embedded wallet exists and the active account is not already it. The address\n * comparison is what prevents a render loop.\n *\n * @example\n * ```ts\n * shouldPinEmbeddedWallet({ enabled: true, ready: true, embeddedAddress: \"0xA\", activeAddress: \"0xB\" }); // true\n * ```\n */\nexport function shouldPinEmbeddedWallet(o: {\n  enabled: boolean;\n  ready: boolean;\n  embeddedAddress: string | undefined;\n  activeAddress: string | undefined;\n}): boolean {\n  if (!o.enabled || !o.ready || !o.embeddedAddress) return false;\n  return o.activeAddress?.toLowerCase() !== o.embeddedAddress.toLowerCase();\n}\n\n/**\n * Generic half of the active-wallet pin: re-asserts the embedded wallet whenever\n * the active account drifts away from it. `useActiveWalletPin` in\n * `/privy/wagmi` supplies wagmi's active address and `setActiveWallet`.\n *\n * Ported from templates/consumer-app/lib/wallet.ts (`useActiveWalletSync`).\n * A user with no embedded wallet is left alone on purpose.\n *\n * @example\n * ```ts\n * usePinEmbeddedWallet({ enabled: true, activeAddress, setActiveWallet });\n * ```\n */\nexport function usePinEmbeddedWallet(o: {\n  enabled: boolean;\n  activeAddress: string | undefined;\n  setActiveWallet: (wallet: ConnectedWallet) => Promise<unknown> | void;\n}): void {\n  const { enabled, activeAddress, setActiveWallet } = o;\n  const { wallets, ready } = useWallets();\n  const embedded = getEmbeddedConnectedWallet(wallets);\n  const embeddedAddress = embedded?.address;\n  useEffect(() => {\n    if (!embedded) return;\n    if (!shouldPinEmbeddedWallet({ enabled, ready, embeddedAddress, activeAddress })) return;\n    void setActiveWallet(embedded);\n  }, [enabled, ready, embedded, embeddedAddress, activeAddress, setActiveWallet]);\n}\n\n// ---------------------------------------------------------------------------\n// Ensure wallet\n// ---------------------------------------------------------------------------\n\ntype FetchInput = Parameters<typeof fetch>[0];\n\nexport type EnsureWalletStatus = \"idle\" | \"checking\" | \"creating\" | \"ready\" | \"stalled\" | \"error\";\n\n/**\n * Provision this user's embedded wallet through the ensure-wallet route (see\n * `createEnsureWalletRoute` in `/privy/server`), not Privy's client-side\n * creation, which hangs for apps with the dashboard's creation setting off.\n * Gates on the EMBEDDED wallet, never on \"any connected wallet\".\n *\n * Ported from templates/consumer-app/components/wallet-gate.tsx.\n *\n * @example\n * ```tsx\n * const { status, address, error, retry } = useEnsureWallet();\n * ```\n */\nexport function useEnsureWallet(o: { endpoint?: string; requestTimeoutMs?: number; appearTimeoutMs?: number } = {}): {\n  status: EnsureWalletStatus;\n  address?: Address;\n  error?: PepuError;\n  retry(): void;\n} {\n  const endpoint = o.endpoint ?? DEFAULT_ENSURE_ENDPOINT;\n  const requestTimeoutMs = o.requestTimeoutMs ?? DEFAULT_ENSURE_REQUEST_TIMEOUT_MS;\n  const appearTimeoutMs = o.appearTimeoutMs ?? DEFAULT_ENSURE_APPEAR_TIMEOUT_MS;\n\n  const { ready: privyReady, authenticated, getAccessToken } = usePrivy();\n  const { wallets, ready: walletsReady } = useWallets();\n  const { refreshUser } = useUser();\n\n  const [error, setError] = useState<PepuError | null>(null);\n  const [requesting, setRequesting] = useState(false);\n  const [confirmed, setConfirmed] = useState<Address | null>(null);\n  const [stalled, setStalled] = useState(false);\n  const [attempt, setAttempt] = useState(0);\n  // The attempt number whose request already settled. An unsettled attempt is\n  // restarted if the effect re-runs (React StrictMode mounts effects twice), a\n  // settled one never is, so a re-render cannot trigger a second POST.\n  const settledFor = useRef(-1);\n  // Latest Privy callbacks, kept out of the effect deps so a new function\n  // identity never cancels an in-flight request.\n  const getAccessTokenRef = useRef(getAccessToken);\n  const refreshUserRef = useRef(refreshUser);\n  getAccessTokenRef.current = getAccessToken;\n  refreshUserRef.current = refreshUser;\n\n  const embedded = getEmbeddedConnectedWallet(wallets);\n  const hasWallet = embedded !== null;\n\n  useEffect(() => {\n    if (!privyReady || !authenticated || !walletsReady || hasWallet) return;\n    if (settledFor.current === attempt) return;\n\n    let cancelled = false;\n    const controller = new AbortController();\n    setRequesting(true);\n    void (async () => {\n      try {\n        const { address } = await requestEnsureWallet({\n          getAccessToken: () => getAccessTokenRef.current(),\n          endpoint,\n          timeoutMs: requestTimeoutMs,\n          signal: controller.signal,\n        });\n        // Pull the server-side change into Privy's client state without a reload.\n        await refreshUserRef.current();\n        if (cancelled) return;\n        settledFor.current = attempt;\n        setConfirmed(address);\n      } catch (e) {\n        if (cancelled) return;\n        settledFor.current = attempt;\n        setError(toPepuError(e, { op: \"ensure wallet\" }));\n      } finally {\n        if (!cancelled) setRequesting(false);\n      }\n    })();\n    return () => {\n      cancelled = true;\n      controller.abort();\n    };\n  }, [privyReady, authenticated, walletsReady, hasWallet, attempt, endpoint, requestTimeoutMs]);\n\n  // Bounded safety net: the server confirmed the wallet, the client never saw it.\n  useEffect(() => {\n    if (!confirmed || hasWallet) return;\n    const id = setTimeout(() => setStalled(true), appearTimeoutMs);\n    return () => {\n      clearTimeout(id);\n      setStalled(false);\n    };\n  }, [confirmed, hasWallet, appearTimeoutMs]);\n\n  const retry = useCallback((): void => {\n    setError(null);\n    setConfirmed(null);\n    setStalled(false);\n    setRequesting(false);\n    setAttempt((n) => n + 1);\n  }, []);\n\n  if (hasWallet) return { status: \"ready\", address: embedded.address as Address, retry };\n  if (!privyReady || !authenticated || !walletsReady) return { status: \"idle\", retry };\n  if (error) return { status: \"error\", error, retry };\n  if (stalled && confirmed) return { status: \"stalled\", address: confirmed, retry };\n  if (confirmed) return { status: \"checking\", address: confirmed, retry };\n  return { status: requesting ? \"creating\" : \"checking\", retry };\n}\n\n/**\n * Renders `children` once the user's embedded wallet exists, provisioning it\n * first through the ensure-wallet route. Shows `loading`, an error (with\n * retry) or a reload prompt when the wallet exists but has not synced yet.\n * Each of the three states takes a render prop (`loading`, `error`, `stalled`)\n * so an app can use the gate directly with its own markup and classes.\n *\n * Ported from templates/consumer-app/components/wallet-gate.tsx.\n *\n * @example\n * ```tsx\n * <WalletGate\n *   loading={<Spinner />}\n *   error={(e, retry) => <button onClick={retry}>{e.message}</button>}\n *   stalled={(address, reload) => <button onClick={reload}>Reload ({address})</button>}\n * >\n *   <Dashboard />\n * </WalletGate>\n * ```\n */\nexport function WalletGate(p: {\n  endpoint?: string;\n  loading?: ReactNode;\n  error?: (e: PepuError, retry: () => void) => ReactNode;\n  /**\n   * The server confirmed the wallet but this session has not seen it after a\n   * bounded wait (a client sync delay). `reload` reloads the page.\n   */\n  stalled?: (address: Address, reload: () => void) => ReactNode;\n  children: ReactNode;\n}): ReactElement {\n  const ensure = useEnsureWallet(p.endpoint !== undefined ? { endpoint: p.endpoint } : {});\n  if (ensure.status === \"ready\") return createElement(Fragment, null, p.children);\n\n  if (ensure.status === \"error\" && ensure.error) {\n    const { error, retry } = ensure;\n    return createElement(\n      Fragment,\n      null,\n      p.error\n        ? p.error(error, retry)\n        : createElement(\n            \"div\",\n            { role: \"alert\" },\n            createElement(\"p\", null, \"Could not create your wallet.\"),\n            createElement(\"p\", null, error.message),\n            createElement(\"button\", { type: \"button\", onClick: retry }, \"Try again\"),\n          ),\n    );\n  }\n\n  if (ensure.status === \"stalled\" && ensure.address) {\n    const a = ensure.address;\n    const reload = (): void => (globalThis as unknown as { location: { reload(): void } }).location.reload();\n    if (p.stalled) return createElement(Fragment, null, p.stalled(a, reload));\n    return createElement(\n      \"div\",\n      { role: \"status\" },\n      createElement(\"p\", null, `Your wallet was created (${a.slice(0, 6)}…${a.slice(-4)}), but it has not appeared in this session yet.`),\n      createElement(\"p\", null, \"This is a client sync delay, not a lost wallet. Reloading usually fixes it.\"),\n      createElement(\"button\", { type: \"button\", onClick: reload }, \"Reload\"),\n    );\n  }\n\n  return createElement(\n    Fragment,\n    null,\n    p.loading ?? createElement(\"div\", { role: \"status\", \"aria-label\": \"Loading\" }, \"Setting up your wallet…\"),\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Authenticated fetch\n// ---------------------------------------------------------------------------\n\n/**\n * A `fetch` that attaches `Authorization: Bearer <Privy access token>`. Throws\n * {@link PepuAuthError} when there is no token (signed out or expired).\n *\n * @example\n * ```tsx\n * const authFetch = usePepuAuthFetch();\n * const res = await authFetch(\"/api/session/status\");\n * ```\n */\nexport function usePepuAuthFetch(): (input: FetchInput, init?: RequestInit) => Promise<Response> {\n  const { getAccessToken } = usePrivy();\n  return useCallback(\n    async (input: FetchInput, init?: RequestInit): Promise<Response> => {\n      const token = await getAccessToken();\n      if (!token) {\n        throw new PepuAuthError(\n          \"AUTH_INVALID_TOKEN\",\n          \"No Privy access token for this session. Sign in again.\",\n        );\n      }\n      const headers = new Headers(init?.headers);\n      headers.set(\"Authorization\", `Bearer ${token}`);\n      return fetch(input, { ...init, headers });\n    },\n    [getAccessToken],\n  );\n}\n"]}

package/dist/chunk-ESMNAXUI.js

@@ -0,0 +1,86 @@
+import { PepuPolicyError } from './chunk-6DSZ4Z2N.js';
+import { toFunctionSelector, toFunctionSignature } from 'viem';
+
+function findFunction(call) {
+  const fn = call.abi.find((item) => item.type === "function" && item.name === call.functionName);
+  if (!fn) {
+    throw new PepuPolicyError("POLICY_UNSCOPED", `The ABI has no function named "${call.functionName}".`);
+  }
+  return fn;
+}
+function assertCalls(calls) {
+  if (calls.length === 0) {
+    throw new PepuPolicyError("POLICY_UNSCOPED", "A session needs at least one allowed call.");
+  }
+  for (const c of calls) {
+    if (!/^0x[0-9a-fA-F]{40}$/.test(c.target)) {
+      throw new PepuPolicyError("POLICY_UNSCOPED", "Every session call needs a valid 0x target address.");
+    }
+    findFunction(c);
+  }
+}
+function describeKernelSessionScope(p) {
+  assertCalls(p.calls);
+  return {
+    calls: p.calls.map((c) => {
+      const fn = findFunction(c);
+      return {
+        target: c.target,
+        functionName: c.functionName,
+        signature: toFunctionSignature(fn).replace(/^function /, ""),
+        selector: toFunctionSelector(fn),
+        maxValueWei: (c.valueLimit ?? 0n).toString()
+      };
+    }),
+    validAfter: p.validAfter ?? 0,
+    validUntil: p.validUntil
+  };
+}
+function isCallInScope(scope, call) {
+  const selector = call.data.slice(0, 10).toLowerCase();
+  return scope.calls.some(
+    (c) => c.target.toLowerCase() === call.to.toLowerCase() && c.selector.toLowerCase() === selector && (call.value ?? 0n) <= BigInt(c.maxValueWei)
+  );
+}
+function decodeBase64Json(text) {
+  const binary = atob(text);
+  const bytes = Uint8Array.from(binary, (ch) => ch.charCodeAt(0));
+  return JSON.parse(new TextDecoder().decode(bytes));
+}
+function parseApproval(approval) {
+  try {
+    const json = decodeBase64Json(approval);
+    if (typeof json !== "object" || json === null) return null;
+    const record = json;
+    const permissionParams = record.permissionParams;
+    const accountParams = record.accountParams;
+    return {
+      permissionId: typeof permissionParams?.permissionId === "string" ? permissionParams.permissionId : null,
+      accountAddress: typeof accountParams?.accountAddress === "string" ? accountParams.accountAddress : null,
+      isPreInstalled: typeof record.isPreInstalled === "boolean" ? record.isPreInstalled : null,
+      hasPrivateKey: typeof record.privateKey === "string" && record.privateKey.length > 0
+    };
+  } catch {
+    return null;
+  }
+}
+function checkApproval(approval, expected) {
+  if (approval.length === 0 || approval.length > 2e4) {
+    return { ok: false, reason: "Approval has an unexpected size." };
+  }
+  const parsed = parseApproval(approval);
+  if (!parsed) return { ok: false, reason: "Approval is not a valid session approval." };
+  if (parsed.hasPrivateKey) return { ok: false, reason: "Approval must not contain a private key." };
+  if (parsed.isPreInstalled !== false) return { ok: false, reason: "Approval must be an enable-mode grant." };
+  if (parsed.accountAddress?.toLowerCase() !== expected.kernelAddress.toLowerCase()) {
+    return { ok: false, reason: "Approval is for a different smart account than yours." };
+  }
+  if (parsed.permissionId?.toLowerCase() !== expected.permissionId.toLowerCase()) {
+    return { ok: false, reason: "Approval does not match the scope, session key or expiry this server issued." };
+  }
+  return { ok: true };
+}
+
+export { assertCalls, checkApproval, describeKernelSessionScope, findFunction, isCallInScope, parseApproval };
+//# sourceMappingURL=chunk-ESMNAXUI.js.map
+//# sourceMappingURL=chunk-ESMNAXUI.js.map

package/dist/chunk-ESMNAXUI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session/scope.ts"],"names":[],"mappings":";;;AAmCO,SAAS,aAAa,IAAA,EAAsC;AACjE,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,CAAC,IAAA,KAA8B,IAAA,CAAK,IAAA,KAAS,UAAA,IAAc,IAAA,CAAK,IAAA,KAAS,IAAA,CAAK,YAAY,CAAA;AACnH,EAAA,IAAI,CAAC,EAAA,EAAI;AACP,IAAA,MAAM,IAAI,eAAA,CAAgB,iBAAA,EAAmB,CAAA,+BAAA,EAAkC,IAAA,CAAK,YAAY,CAAA,EAAA,CAAI,CAAA;AAAA,EACtG;AACA,EAAA,OAAO,EAAA;AACT;AAEO,SAAS,YAAY,KAAA,EAA2C;AACrE,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,eAAA,CAAgB,iBAAA,EAAmB,4CAA4C,CAAA;AAAA,EAC3F;AACA,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI,CAAC,qBAAA,CAAsB,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AACzC,MAAA,MAAM,IAAI,eAAA,CAAgB,iBAAA,EAAmB,qDAAqD,CAAA;AAAA,IACpG;AACA,IAAA,YAAA,CAAa,CAAC,CAAA;AAAA,EAChB;AACF;AAUO,SAAS,2BAA2B,CAAA,EAIpB;AACrB,EAAA,WAAA,CAAY,EAAE,KAAK,CAAA;AACnB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM;AACxB,MAAA,MAAM,EAAA,GAAK,aAAa,CAAC,CAAA;AACzB,MAAA,OAAO;AAAA,QACL,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,cAAc,CAAA,CAAE,YAAA;AAAA,QAChB,WAAW,mBAAA,CAAoB,EAAE,CAAA,CAAE,OAAA,CAAQ,cAAc,EAAE,CAAA;AAAA,QAC3D,QAAA,EAAU,mBAAmB,EAAE,CAAA;AAAA,QAC/B,WAAA,EAAA,CAAc,CAAA,CAAE,UAAA,IAAc,EAAA,EAAI,QAAA;AAAS,OAC7C;AAAA,IACF,CAAC,CAAA;AAAA,IACD,UAAA,EAAY,EAAE,UAAA,IAAc,CAAA;AAAA,IAC5B,YAAY,CAAA,CAAE;AAAA,GAChB;AACF;AAUO,SAAS,aAAA,CACd,OACA,IAAA,EACS;AACT,EAAA,MAAM,WAAW,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,EAAG,EAAE,EAAE,WAAA,EAAY;AACpD,EAAA,OAAO,MAAM,KAAA,CAAM,IAAA;AAAA,IACjB,CAAC,MACC,CAAA,CAAE,MAAA,CAAO,aAAY,KAAM,IAAA,CAAK,GAAG,WAAA,EAAY,IAC/C,EAAE,QAAA,CAAS,WAAA,OAAkB,QAAA,IAAA,CAC5B,IAAA,CAAK,SAAS,EAAA,KAAO,MAAA,CAAO,EAAE,WAAW;AAAA,GAC9C;AACF;AAUA,SAAS,iBAAiB,IAAA,EAAuB;AAC/C,EAAA,MAAM,MAAA,GAAS,KAAK,IAAI,CAAA;AACxB,EAAA,MAAM,KAAA,GAAQ,WAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAC,CAAA;AAC9D,EAAA,OAAO,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA;AACnD;AASO,SAAS,cAAc,QAAA,EAAyC;AACrE,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,iBAAiB,QAAQ,CAAA;AACtC,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,MAAM,OAAO,IAAA;AACtD,IAAA,MAAM,MAAA,GAAS,IAAA;AACf,IAAA,MAAM,mBAAmB,MAAA,CAAO,gBAAA;AAChC,IAAA,MAAM,gBAAgB,MAAA,CAAO,aAAA;AAC7B,IAAA,OAAO;AAAA,MACL,cAAc,OAAO,gBAAA,EAAkB,YAAA,KAAiB,QAAA,GAAW,iBAAiB,YAAA,GAAe,IAAA;AAAA,MACnG,gBAAgB,OAAO,aAAA,EAAe,cAAA,KAAmB,QAAA,GAAW,cAAc,cAAA,GAAiB,IAAA;AAAA,MACnG,gBAAgB,OAAO,MAAA,CAAO,cAAA,KAAmB,SAAA,GAAY,OAAO,cAAA,GAAiB,IAAA;AAAA,MACrF,eAAe,OAAO,MAAA,CAAO,eAAe,QAAA,IAAY,MAAA,CAAO,WAAW,MAAA,GAAS;AAAA,KACrF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAgBO,SAAS,aAAA,CACd,UACA,QAAA,EACe;AACf,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,QAAA,CAAS,SAAS,GAAA,EAAQ;AACrD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kCAAA,EAAmC;AAAA,EACjE;AACA,EAAA,MAAM,MAAA,GAAS,cAAc,QAAQ,CAAA;AACrC,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,2CAAA,EAA4C;AACrF,EAAA,IAAI,OAAO,aAAA,EAAe,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,0CAAA,EAA2C;AACjG,EAAA,IAAI,MAAA,CAAO,mBAAmB,KAAA,EAAO,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,wCAAA,EAAyC;AAC1G,EAAA,IAAI,OAAO,cAAA,EAAgB,WAAA,OAAkB,QAAA,CAAS,aAAA,CAAc,aAAY,EAAG;AACjF,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,uDAAA,EAAwD;AAAA,EACtF;AACA,EAAA,IAAI,OAAO,YAAA,EAAc,WAAA,OAAkB,QAAA,CAAS,YAAA,CAAa,aAAY,EAAG;AAC9E,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,8EAAA,EAA+E;AAAA,EAC7G;AACA,EAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AACpB","file":"chunk-ESMNAXUI.js","sourcesContent":["import { toFunctionSelector, toFunctionSignature } from \"viem\";\nimport type { Abi, AbiFunction, Address, Hex } from \"viem\";\n\nimport { PepuPolicyError } from \"../errors.js\";\n\n/**\n * Pure Kernel session helpers (scope types, consent-screen data, call-in-scope\n * check, approval parsing). They need only `viem`, so they load without any\n * `@zerodev/*` peer. Also re-exported from `@pepu-chain/sdk/session/kernel`.\n */\n\n/** One function a session may call on one contract. */\nexport interface KernelSessionCall {\n  target: Address;\n  abi: Abi;\n  functionName: string;\n  /** Max native value per call, in wei. Default `0n`. */\n  valueLimit?: bigint;\n}\n\n/** What a Kernel session allows, as plain data for a consent screen. */\nexport interface KernelSessionScope {\n  calls: {\n    target: Address;\n    functionName: string;\n    /** e.g. `tap()`. */\n    signature: string;\n    selector: Hex;\n    /** Max value per call in wei, as a decimal string. */\n    maxValueWei: string;\n  }[];\n  validAfter: number;\n  validUntil: number;\n}\n\nexport function findFunction(call: KernelSessionCall): AbiFunction {\n  const fn = call.abi.find((item): item is AbiFunction => item.type === \"function\" && item.name === call.functionName);\n  if (!fn) {\n    throw new PepuPolicyError(\"POLICY_UNSCOPED\", `The ABI has no function named \"${call.functionName}\".`);\n  }\n  return fn;\n}\n\nexport function assertCalls(calls: readonly KernelSessionCall[]): void {\n  if (calls.length === 0) {\n    throw new PepuPolicyError(\"POLICY_UNSCOPED\", \"A session needs at least one allowed call.\");\n  }\n  for (const c of calls) {\n    if (!/^0x[0-9a-fA-F]{40}$/.test(c.target)) {\n      throw new PepuPolicyError(\"POLICY_UNSCOPED\", \"Every session call needs a valid 0x target address.\");\n    }\n    findFunction(c);\n  }\n}\n\n/**\n * Consent-screen data: each allowed call with its selector, the value limit\n * and the expiry. Pure.\n *\n * @example\n * const scope = describeKernelSessionScope({ calls, validUntil });\n * scope.calls[0]?.signature; // \"tap()\"\n */\nexport function describeKernelSessionScope(p: {\n  calls: readonly KernelSessionCall[];\n  validUntil: number;\n  validAfter?: number;\n}): KernelSessionScope {\n  assertCalls(p.calls);\n  return {\n    calls: p.calls.map((c) => {\n      const fn = findFunction(c);\n      return {\n        target: c.target,\n        functionName: c.functionName,\n        signature: toFunctionSignature(fn).replace(/^function /, \"\"),\n        selector: toFunctionSelector(fn),\n        maxValueWei: (c.valueLimit ?? 0n).toString(),\n      };\n    }),\n    validAfter: p.validAfter ?? 0,\n    validUntil: p.validUntil,\n  };\n}\n\n/**\n * True when `call` (target plus 4-byte selector, value) is inside `scope`.\n * Used server-side to fail fast before sponsoring; the chain still enforces\n * the real limit. Pure.\n *\n * @example\n * isCallInScope(scope, { to, data, value: 0n });\n */\nexport function isCallInScope(\n  scope: Pick<KernelSessionScope, \"calls\">,\n  call: { to: Address; data: Hex; value?: bigint },\n): boolean {\n  const selector = call.data.slice(0, 10).toLowerCase();\n  return scope.calls.some(\n    (c) =>\n      c.target.toLowerCase() === call.to.toLowerCase() &&\n      c.selector.toLowerCase() === selector &&\n      (call.value ?? 0n) <= BigInt(c.maxValueWei),\n  );\n}\n\n/** Parsed fields of an `approval` string. */\nexport interface ParsedApproval {\n  permissionId: string | null;\n  accountAddress: string | null;\n  isPreInstalled: boolean | null;\n  hasPrivateKey: boolean;\n}\n\nfunction decodeBase64Json(text: string): unknown {\n  const binary = atob(text);\n  const bytes = Uint8Array.from(binary, (ch) => ch.charCodeAt(0));\n  return JSON.parse(new TextDecoder().decode(bytes));\n}\n\n/**\n * Parse a serialized approval (base64 JSON from `serializePermissionAccount`)\n * without trusting it. Returns `null` when it is not an approval at all.\n *\n * @example\n * parseApproval(approval)?.permissionId;\n */\nexport function parseApproval(approval: string): ParsedApproval | null {\n  try {\n    const json = decodeBase64Json(approval);\n    if (typeof json !== \"object\" || json === null) return null;\n    const record = json as Record<string, unknown>;\n    const permissionParams = record.permissionParams as { permissionId?: unknown } | undefined;\n    const accountParams = record.accountParams as { accountAddress?: unknown } | undefined;\n    return {\n      permissionId: typeof permissionParams?.permissionId === \"string\" ? permissionParams.permissionId : null,\n      accountAddress: typeof accountParams?.accountAddress === \"string\" ? accountParams.accountAddress : null,\n      isPreInstalled: typeof record.isPreInstalled === \"boolean\" ? record.isPreInstalled : null,\n      hasPrivateKey: typeof record.privateKey === \"string\" && record.privateKey.length > 0,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/** Result of {@link checkApproval}. */\nexport type ApprovalCheck = { ok: true } | { ok: false; reason: string };\n\n/**\n * Check a browser-supplied approval before the server stores it. It rejects a\n * payload that carries a private key, is not an enable-mode grant, is for\n * another account, or whose permission id differs from the one this server\n * issued (so scope, session key or expiry changed). The approval is untrusted\n * input; the chain enforces the real limits regardless.\n *\n * @example\n * const check = checkApproval(approval, { kernelAddress, permissionId });\n * if (!check.ok) console.log(check.reason);\n */\nexport function checkApproval(\n  approval: string,\n  expected: { kernelAddress: Address; permissionId: string },\n): ApprovalCheck {\n  if (approval.length === 0 || approval.length > 20_000) {\n    return { ok: false, reason: \"Approval has an unexpected size.\" };\n  }\n  const parsed = parseApproval(approval);\n  if (!parsed) return { ok: false, reason: \"Approval is not a valid session approval.\" };\n  if (parsed.hasPrivateKey) return { ok: false, reason: \"Approval must not contain a private key.\" };\n  if (parsed.isPreInstalled !== false) return { ok: false, reason: \"Approval must be an enable-mode grant.\" };\n  if (parsed.accountAddress?.toLowerCase() !== expected.kernelAddress.toLowerCase()) {\n    return { ok: false, reason: \"Approval is for a different smart account than yours.\" };\n  }\n  if (parsed.permissionId?.toLowerCase() !== expected.permissionId.toLowerCase()) {\n    return { ok: false, reason: \"Approval does not match the scope, session key or expiry this server issued.\" };\n  }\n  return { ok: true };\n}\n\n"]}

package/dist/chunk-ET3P6TX6.cjs

@@ -0,0 +1,49 @@
+'use strict';
+
+var chunkTIEAZYHF_cjs = require('./chunk-TIEAZYHF.cjs');
+var chunkDPCZJLB3_cjs = require('./chunk-DPCZJLB3.cjs');
+var viem = require('viem');
+
+function buildPaymasterContext(entries = {}) {
+  const context = {};
+  for (const [key, value] of Object.entries(entries)) {
+    if (value === void 0) continue;
+    const kind = typeof value;
+    if (kind === "bigint" || kind === "function" || kind === "symbol") {
+      throw new Error(
+        `buildPaymasterContext: "${key}" is a ${kind}, which is not JSON-serializable. Convert it to a string or number first.`
+      );
+    }
+    context[key] = value;
+  }
+  return context;
+}
+function buildParams(options) {
+  const entryPointEntry = chunkTIEAZYHF_cjs.getContract(chunkDPCZJLB3_cjs.pepuMainnet.id, "entryPoint07");
+  const entryPoint = options.entryPoint ?? (entryPointEntry?.status === "deployed" ? entryPointEntry.address : void 0);
+  if (!entryPoint) throw new Error("buildPaymasterRequest: no EntryPoint v0.7 address available.");
+  const chainId = viem.toHex(options.chainId ?? chunkDPCZJLB3_cjs.pepuMainnet.id);
+  return options.context ? [options.userOperation, entryPoint, chainId, options.context] : [options.userOperation, entryPoint, chainId];
+}
+function buildPaymasterStubDataRequest(options) {
+  return {
+    jsonrpc: "2.0",
+    id: options.id ?? 1,
+    method: "pm_getPaymasterStubData",
+    params: buildParams(options)
+  };
+}
+function buildPaymasterDataRequest(options) {
+  return {
+    jsonrpc: "2.0",
+    id: options.id ?? 1,
+    method: "pm_getPaymasterData",
+    params: buildParams(options)
+  };
+}
+
+exports.buildPaymasterContext = buildPaymasterContext;
+exports.buildPaymasterDataRequest = buildPaymasterDataRequest;
+exports.buildPaymasterStubDataRequest = buildPaymasterStubDataRequest;
+//# sourceMappingURL=chunk-ET3P6TX6.cjs.map
+//# sourceMappingURL=chunk-ET3P6TX6.cjs.map

package/dist/chunk-ET3P6TX6.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/erc7677.ts"],"names":["getContract","pepuMainnet","toHex"],"mappings":";;;;;;AAkGO,SAAS,qBAAA,CACd,OAAA,GAA6C,EAAC,EAC5B;AAClB,EAAA,MAAM,UAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,OAAO,OAAO,KAAA;AACpB,IAAA,IAAI,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,UAAA,IAAc,SAAS,QAAA,EAAU;AACjE,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,wBAAA,EAA2B,GAAG,CAAA,OAAA,EAAU,IAAI,CAAA,yEAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,GAAG,CAAA,GAAI,KAAA;AAAA,EACjB;AACA,EAAA,OAAO,OAAA;AACT;AAYA,SAAS,YAAY,OAAA,EAA2D;AAC9E,EAAA,MAAM,eAAA,GAAkBA,6BAAA,CAAYC,6BAAA,CAAY,EAAA,EAAI,cAAc,CAAA;AAClE,EAAA,MAAM,aACJ,OAAA,CAAQ,UAAA,KACP,iBAAiB,MAAA,KAAW,UAAA,GAAa,gBAAgB,OAAA,GAAU,MAAA,CAAA;AACtE,EAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAC/F,EAAA,MAAM,OAAA,GAAUC,UAAA,CAAM,OAAA,CAAQ,OAAA,IAAWD,8BAAY,EAAE,CAAA;AACvD,EAAA,OAAO,OAAA,CAAQ,OAAA,GACX,CAAC,OAAA,CAAQ,eAAe,UAAA,EAAY,OAAA,EAAS,OAAA,CAAQ,OAAO,CAAA,GAC5D,CAAC,OAAA,CAAQ,aAAA,EAAe,YAAY,OAAO,CAAA;AACjD;AAGO,SAAS,8BACd,OAAA,EAC0B;AAC1B,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,EAAA,EAAI,QAAQ,EAAA,IAAM,CAAA;AAAA,IAClB,MAAA,EAAQ,yBAAA;AAAA,IACR,MAAA,EAAQ,YAAY,OAAO;AAAA,GAC7B;AACF;AAGO,SAAS,0BACd,OAAA,EACsB;AACtB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,EAAA,EAAI,QAAQ,EAAA,IAAM,CAAA;AAAA,IAClB,MAAA,EAAQ,qBAAA;AAAA,IACR,MAAA,EAAQ,YAAY,OAAO;AAAA,GAC7B;AACF","file":"chunk-ET3P6TX6.cjs","sourcesContent":["import { toHex } from \"viem\";\nimport type { Address, Hex } from \"viem\";\n\nimport { pepuMainnet } from \"./chains.js\";\nimport { getContract } from \"./contracts.js\";\n\n/**\n * ERC-7677 paymaster web-service types, for the two JSON-RPC methods PEPU's\n * paymaster policy service implements: `pm_getPaymasterStubData` and\n * `pm_getPaymasterData`. See https://eips.ethereum.org/EIPS/eip-7677.\n *\n * Pure types plus a few tiny builders: no network, no secrets, safe in a\n * browser bundle. Quantities are `0x`-prefixed hex strings, as on the wire.\n *\n * Note this package never implies sponsorship is available to an app: see\n * `getSponsorshipStatus()`. These types describe the protocol only.\n */\n\n/** An ERC-4337 v0.7 UserOperation in its unpacked JSON-RPC shape. */\nexport interface Erc7677UserOperation {\n  sender: Address;\n  nonce: Hex;\n  factory?: Address;\n  factoryData?: Hex;\n  callData: Hex;\n  callGasLimit: Hex;\n  verificationGasLimit: Hex;\n  preVerificationGas: Hex;\n  maxFeePerGas: Hex;\n  maxPriorityFeePerGas: Hex;\n  paymaster?: Address;\n  paymasterVerificationGasLimit?: Hex;\n  paymasterPostOpGasLimit?: Hex;\n  paymasterData?: Hex;\n  signature: Hex;\n}\n\n/** Paymaster-defined, JSON-serializable context (params[3]). */\nexport type PaymasterContext = Record<string, unknown>;\n\nexport type PaymasterRpcParams = readonly [\n  userOperation: Partial<Erc7677UserOperation> & Pick<Erc7677UserOperation, \"sender\" | \"callData\">,\n  entryPoint: Address,\n  chainId: Hex,\n  context?: PaymasterContext,\n];\n\nexport interface PaymasterStubDataRequest {\n  jsonrpc: \"2.0\";\n  id: number | string;\n  method: \"pm_getPaymasterStubData\";\n  params: PaymasterRpcParams;\n}\n\nexport interface PaymasterDataRequest {\n  jsonrpc: \"2.0\";\n  id: number | string;\n  method: \"pm_getPaymasterData\";\n  params: PaymasterRpcParams;\n}\n\n/** Result of `pm_getPaymasterStubData`. Stub values are for gas estimation only. */\nexport interface PaymasterStubDataResult {\n  paymaster: Address;\n  paymasterData: Hex;\n  paymasterVerificationGasLimit?: Hex;\n  paymasterPostOpGasLimit?: Hex;\n  /** `true` when the stub values are also the final values. */\n  isFinal?: boolean;\n  sponsor?: { name: string; icon?: string };\n}\n\n/** Result of `pm_getPaymasterData`: the signed values to submit. */\nexport interface PaymasterDataResult {\n  paymaster: Address;\n  paymasterData: Hex;\n  paymasterVerificationGasLimit?: Hex;\n  paymasterPostOpGasLimit?: Hex;\n}\n\nexport interface PaymasterRpcError {\n  code: number;\n  message: string;\n  /** PEPU's policy service puts the machine-readable denial reason in `data.reason`. */\n  data?: { reason?: string } & Record<string, unknown>;\n}\n\nexport type PaymasterRpcResponse<TResult> =\n  | { jsonrpc: \"2.0\"; id: number | string | null; result: TResult }\n  | { jsonrpc: \"2.0\"; id: number | string | null; error: PaymasterRpcError };\n\n/**\n * Build a paymaster `context` object: drops `undefined` entries and throws on\n * anything that would not survive `JSON.stringify` (bigint, function, symbol),\n * so a bad value fails here instead of as an opaque RPC error. Returns `{}`\n * for no input. The context is paymaster-defined; PEPU's policy service\n * currently accepts and ignores it.\n */\nexport function buildPaymasterContext(\n  entries: Readonly<Record<string, unknown>> = {},\n): PaymasterContext {\n  const context: PaymasterContext = {};\n  for (const [key, value] of Object.entries(entries)) {\n    if (value === undefined) continue;\n    const kind = typeof value;\n    if (kind === \"bigint\" || kind === \"function\" || kind === \"symbol\") {\n      throw new Error(\n        `buildPaymasterContext: \"${key}\" is a ${kind}, which is not JSON-serializable. Convert it to a string or number first.`,\n      );\n    }\n    context[key] = value;\n  }\n  return context;\n}\n\nexport interface BuildPaymasterRequestOptions {\n  userOperation: PaymasterRpcParams[0];\n  /** Defaults to PEPU mainnet's EntryPoint v0.7. */\n  entryPoint?: Address;\n  /** Defaults to 97741 (PEPU mainnet). */\n  chainId?: number;\n  context?: PaymasterContext;\n  id?: number | string;\n}\n\nfunction buildParams(options: BuildPaymasterRequestOptions): PaymasterRpcParams {\n  const entryPointEntry = getContract(pepuMainnet.id, \"entryPoint07\");\n  const entryPoint =\n    options.entryPoint ??\n    (entryPointEntry?.status === \"deployed\" ? entryPointEntry.address : undefined);\n  if (!entryPoint) throw new Error(\"buildPaymasterRequest: no EntryPoint v0.7 address available.\");\n  const chainId = toHex(options.chainId ?? pepuMainnet.id);\n  return options.context\n    ? [options.userOperation, entryPoint, chainId, options.context]\n    : [options.userOperation, entryPoint, chainId];\n}\n\n/** Build a `pm_getPaymasterStubData` JSON-RPC request body. */\nexport function buildPaymasterStubDataRequest(\n  options: BuildPaymasterRequestOptions,\n): PaymasterStubDataRequest {\n  return {\n    jsonrpc: \"2.0\",\n    id: options.id ?? 1,\n    method: \"pm_getPaymasterStubData\",\n    params: buildParams(options),\n  };\n}\n\n/** Build a `pm_getPaymasterData` JSON-RPC request body. */\nexport function buildPaymasterDataRequest(\n  options: BuildPaymasterRequestOptions,\n): PaymasterDataRequest {\n  return {\n    jsonrpc: \"2.0\",\n    id: options.id ?? 1,\n    method: \"pm_getPaymasterData\",\n    params: buildParams(options),\n  };\n}\n"]}